1

I've written a PAM service module, and added it into lightdm by editing /etc/pam.d/lightdm.

But lightdm complains (in /var/log/auth.log on Ubuntu 14.04):

Sep  9 14:16:48 Ubuntu-build lightdm: PAM unable to dlopen(pam_my.so): /lib/security/pam_my.so: cannot open shared object file: No such file or directory

When I look at what's happening via strace(), contrary to the log message it is finding and opening my PAM module, and starting to inspect it, but then it gives up and keeps searching for it in other directories, ultimately complaining it couldn't find it. Here's some sample output:

12230 open("/lib/x86_64-linux-gnu/security/pam_my.so", O_RDONLY|O_CLOEXEC) = 4
12230 read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0000\f\0\0\0\0\0\0"..., 832) = 832
12230 fstat(4, {st_mode=S_IFREG|0644, st_size=17728, ...}) = 0
12230 mmap(NULL, 2105544, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7fe087ebe000
12230 mprotect(0x7fe087ec0000, 2093056, PROT_NONE) = 0
12230 mmap(0x7fe0880bf000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x1000) = 0x7fe0880bf000
12230 close(4)                          = 0

In a working case (e.g. pam_unix.so) instead of the close() it continues with another mmap() and then proceeds. I've looked in all the logs in /var/log/* and can't find any more information to tell me what PAM is unhappy about. I don't even know what source I could look at to diagnose what's going wrong. The module appears to be built correctly. I've read the Module Writers Guide and think I'm following all the right rules. Any clues on how to proceed to diagnose this?

I also tried touching /etc/pam_debug but that didn't provide any useful log messages.

4
  • Usually when this happens it means that the binary is for a different architecture than the rest of the system. Run this file /lib/x86_64-linux-gnu/security/pam_my.so, see what architecture it is. Compare with /lib/x86_64-linux-gnu/security/pam_access.so.
    – bahamat
    Sep 9, 2014 at 19:32
  • Thanks, but I did that and it looks identical. Sep 9, 2014 at 19:35
  • I even downloaded the Linux-PAM sources and compared against pam_permit.c to verify that I have identical function signatures defined. I'm wondering if it could be a difference in link flags and am pursuing that. Sep 9, 2014 at 19:36
  • I took the source to Linux-PAM module pam_permit, and built it the same way, and it works fine. So it's something about the code itself. Nothing visually different in the function signatures. I'll have to incrementally move from one to the other to see what works. Sep 10, 2014 at 0:03

1 Answer 1

0

Problem solved. For the record, here is how I diagnosed:

  1. Downloaded the Linux-PAM sources from https://git.fedorahosted.org/cgit/linux-pam.git
  2. Replaced my source with the contents of pam_permit.c (a very simple module that always succeeds without user interaction)
  3. Inspected the build of reference source to determine any difference.

I discovered when I added the linker flag --no-undefined and explicitly linked in the pam and dl libraries, that I had an undefined symbol (strlcpy, which exists only in BSD Unix) and this was preventing the library from loading.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .